'forensics' 검색 결과

Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and analyze heap spray attacks in memory dumps using Volatility3 plugins to identify NOP sled patterns, shellcode landing zones, and suspicious large allocations in process virtual address space.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse and analyze Linux auditd logs to detect intrusion indicators including unauthorized file access, privilege escalation, syscall anomalies, and suspicious process execution using ausearch and Python.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security testing

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration, steganographic HTTP, and protocol abuse for C2 and data exfiltration.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Practical incident-response runbook for a suspected or confirmed ComfyUI / GPU-daemon compromise. Triage, scope, contain, forensic collection, weight-integrity verification, rebuild from clean snapshot, postmortem. NOT for hygiene scans on a healthy box (use supply-chain-defense-for-ml-extensions), and NOT for runtime hardening of a fresh deployment (use gpu-hosted-asset-hardening).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

|

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Post-mortem investigation for failed GSD workflows — analyzes git history, artifacts, and state to diagnose what went wrong

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch analysis of audio files, generates confidence scores, and produces forensic reports. Activates for requests involving deepfake voice detection, vishing investigation, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.